ShareInfo
Mobile-ID public company timeline · 10/02/2026
Publicly documented within RAR/VNeID cooperation; the site does not expand it into full KYC.
Receive authorized attributes under purpose and consent; validate callbacks and data boundaries.
RSS 1.11.260911 §2.9–2.10 describes sharing initialization and retrieval. Sign-in, sharing consent and signing results are three separate objects.
| Field/header | Meaning |
|---|---|
x-rp-id | Caller reference, retained to reconcile the application request. |
x-billcode-id | Service tracking reference; do not rename it transaction_id. |
data.transaction_code | Sharing initialization reference; not shared attributes or a signature. |
x-transaction-code / x-target-code | Headers in the lookup table; source examples differ and must be confirmed before calls. |
data.user_info_token | JWS result token; verify origin and scope under the confirmed trust contract. |
Mobile-ID public company timeline · 10/02/2026
Publicly documented within RAR/VNeID cooperation; the site does not expand it into full KYC.
Attribute sharing
Attribute sharing is described only within applicable consent/scope.
Policy principle
Applications should request only the data needed for the transaction.
Mobile-ID Sign does not equate ShareInfo with an entire KYC process. Only attributes requested within service scope and appropriate consent/authorization belong to the transaction; specific fields are not invented without a contract.
Persist the business reference and request state; prepare the approved redirect.
Orchestrate the request and maintain separate correlation for authentication, attribute sharing and signing.
Authenticate through the applicable service; the user grants or denies consent.
Receive authorized attributes and validate the state against the initiated request.
Request separate signing authorization on the applicable route; login is not consent to sign.
Create the signature within provider scope and return it for validation and reconciliation.
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Outcome | Application / operator action |
|---|---|
| Cancel or deny | Return the user outcome; do not initiate signing. |
| Timeout or expired challenge | Reconcile first; create a new request only with renewed user confirmation. |
| Callback state mismatch | Reject and investigate correlation, session and redirect binding. |
| Attribute unavailable or denied | Apply business policy; never substitute inferred identity data. |
| Signing provider unavailable | Preserve the uncertain state; reconcile or escalate without silently switching routes. |
If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.
| Component | Responsibility | Evidence to review |
|---|---|---|
| Enterprise | Business record, representative authority and acceptance | Record reference, version and approval |
| Mobile-ID | Contract-scoped orchestration, correlation and handoff | Request, callback, state and audit |
| RAR/C06 / VNeID | Applicable identity / attribute service | Authentication result and consent scope |
| CA / RSSP | Signing credential and signature creation | Certificate, signed output and verification |
Successful sign-in does not grant unrestricted attributes. The application defines purpose, requested fields and consent, and uses results only within the agreed scope.
If the user refuses or has not confirmed, do not fabricate a sharing result. On response loss, retain identifiers for lookup or support under the contract; shared data is not signing authority.
Review SSO session boundaries